Commit Graph

353 Commits

Author SHA1 Message Date
gbe
8c7a914707 syslog.conf(5): Fix a few mandoc warnings
- new sentence, new line
- skipping paragraph macro: Pp at the end of Sh
2020-11-20 16:50:52 +00:00
cy
311488b598 Fix build post-r367455.
MFC after:	2 weeks
X-MFC with:	r367455
2020-11-07 19:17:37 +00:00
bdrewery
258a45da7f syslogd: Stop trying to send remote messages through special sockets
Specifically this was causing the /dev/klog fd and the signal pipe
handling fd to get a sendmsg(2) called on them and always returned
[ENOTSOCK].

r310350 combined these sockets into the main socket list and properly
skipped AF_UNSPEC at the sendmsg(2) call but later in r344739 it was
broken such that these special sockets were no longer excluded since
the AF_UNSPEC check specifically excluded these special sockets. Only
these special sockets have sl_sa = NULL. The sl_family checks should
be redundant now but are left in case of future changes so the intent
is clearer.

MFC after:	2 weeks
2020-11-07 17:18:44 +00:00
markj
be5f1eac4c syslogd: Avoid trimming host names in RFC 5424 mode
RFC 5424 says that implementations should log hostnames in FQDN
format.  Only trim host names in RFC 3164 mode.

PR:		250014
Submitted by:	Dmitry Wagin <dmitry.wagin@ya.ru>
MFC after:	1 month
Differential Revision:	https://reviews.freebsd.org/D26644
2020-10-09 15:19:29 +00:00
bdrewery
3998e1ca9c Restore local kernel "prog" filtering lost in r332099.
This behavior is most relevant for ipfw(4) as documented in syslog.conf(5).
The recent addition of property-based regex filters in r359327 is a
fine workaround for this but the behavior was present since 1997 and
documented.

This only fixes local matching of the "kernel program". It does not
change the forwarded format at all. On the remote side it will still
be "kernel: ipfw:" and not be parsed as a kernel message. This matches
old behavior.

MFC after:	2 weeks
Reviewed by:	markj
Relnotes:	yes
Differential Revision:	https://reviews.freebsd.org/D24286
2020-04-28 16:07:15 +00:00
ae
c9e876cd63 Fix typo.
MFC after:	2 weeks
2020-03-26 12:00:26 +00:00
ae
b05729bd6a Add property-based filters for syslogd.
Property-based filters allow substring and regular expressions
(see re_format(7)) matching against various message attributes.
Filter specification starts with '#:' or ':' followed by three
comma-separated fields property, operator, "value". Value must be
double-quoted. A double quote and backslash must be escaped by a
blackslash.

Following properties are supported as test value:
o msg - body of the message received;
o programname - program name sent the message;
o hostname - hostname of message's originator;
o source - an alias for hostname.

Supported operators:
o contains - true if filter value is found as a substring of property;
o isequal - true if filter value is equal to property;
o startswith - true if property starts with filter value;
o regex - true if property matches basic regular expression defined
    in filter value;
o ereregex - true if property matches extended regular expression
    defined in filter value;

Operator may be prefixed by '!' to invert compare logic or by
'icase_' to make comparison function case insensitive.

Submitted by:	Boris N. Lytochkin <lytboris at gmail com>
MFC after:	2 weeks
Relnotes:	yes
Differential Revision:	https://reviews.freebsd.org/D23468
2020-03-26 11:54:25 +00:00
swills
f3228a13d3 log daemon.info to /var/log/daemon.log by default
log daemon facility now that daemon(8) has syslog support which defaults to
daemon facility, info priority

Reviewed by:		bapt
Approved by:		bapt
Differential Revision:	https://reviews.freebsd.org/D21561
2019-09-17 20:03:20 +00:00
bz
ba9633beef Fix compilation of world with WITHOUT_{INET,INET6}_SUPPORT or both set.
Buildworld failed when both WITHOUT_INET6_SUPPORT and INET equivalent were set.
Fix netstat and syslogd by applying appropriate #ifdef INET/INET6 to make world
compile again.

Reviewed by:		ngie, hrs, ume
Welcomed by:		Michael Dexter (D17040)
MFC after:		3 days
Differential Revision:	https://reviews.freebsd.org/D19418
2019-03-03 10:00:26 +00:00
hrs
1184850228 Use struct addrinfo instead of struct sockaddr_storage
to store peer addresses.
2019-03-03 05:30:15 +00:00
ume
e559c2d26e An IPv6 address matching should be fixed. Specifying an IPv6
address by the -a option was broken since r309933.

Reported by:	"O. Hartmann" <ohartmann [...] walstatt.org>
MFC after:	1 week
2019-02-24 03:41:05 +00:00
brd
4990877585 Remove trailing slash in pathname so that valid METALOG is created in the
NO_ROOT case of make packages.

Submitted by:	Dan McGregor <dan.mcgregor@usask.ca>
Approved by:	re (rgrimes)
2018-08-25 20:19:16 +00:00
brd
5a13a2d634 Move all syslogd related configs to usr.sbin/syslogd/
This helps with pkgbase as it switches these to use CONFS which properly tags
them as config files.

Approved by:	will (mentor)
Differential Revision:	https://reviews.freebsd.org/D16783
2018-08-21 17:01:47 +00:00
ed
ae3584cee7 Allow the use of slashes in process names of RFC 3164 formatted messages.
Tools such as Postfix use slashes in process names for hierarchy
(postfix/qmgr). By allowing these slashes, syslogd is able to extract
the process name and process ID nicely, so that they can be stored in
RFC 5424 message fields.

MFC after:	1 week
2018-07-07 11:53:39 +00:00
ed
5102fab09b Document that syslogd -v has no effect when RFC 5424 mode is enabled.
The variable it sets, LogFacPri, is only used in the RFC 3164 formatting
codepath.

PR:		229457
Reported by:	Andre Albsmeier
MFC after:	1 week
2018-07-02 11:02:27 +00:00
ed
6ee03e0408 Restore the order in which RFC 3164 messages with fac/pri are formatted.
The refactoring of the syslogd code to format messages using iovecs
slightly altered the output of syslogd by placing the facility/priority
after the hostname, as opposed to printing it right before. This change
reverts the behaviour to be consistent with how it was before.

PR:		229457
Reported by:	Andre Albsmeier
MFC after:	1 week
2018-07-02 10:57:22 +00:00
ed
335720eb73 Still parse messages that don't contain an RFC 3164 timestamp.
The changes made in r326573 required that messages always start with an
RFC 3164 timestamp. It looks like certain devices, but also certain
logging libraries (Python 3's "logging" package) simply don't generate
RFC 3164 formatted messages containing a timestamp.

Make timestamps optional again. When the timestamp is missing, also
assume that the message contains no hostname. The first word of the
message likely already belongs to the message payload.

PR:		229236
Reported by:	Michael Grimm & Marek Zarychta
Reviewed by:	glebius (cursory)
MFC after:	1 week
2018-06-22 20:53:39 +00:00
ed
912be99355 Fix bad logic in iovlist_truncate().
To conform to RFC 5426, this function is intended to truncate messages
if they exceed the message size limits. Unfortunately, the amount of
space was computed the wrong way around, causing messages to be
truncated entirely.

Reported by:	Michael Grimm on stable@
MFC after:	3 days
2018-06-18 06:01:28 +00:00
delphij
9fc237c32b Correct size for allocation and bzero of fdsr.
MFC after:	2 weeks
2018-04-23 07:15:49 +00:00
ed
120703a30a Use proper alphabetic sorting of options. 2018-04-15 08:44:26 +00:00
ed
d178bf0959 Add RFC 5424 syslog message output to syslogd.
- Move all of the code responsible for transmitting log messages into a
  separate function, fprintlog_write().
- Instead of manually modifying a list of iovecs, add a structure
  iovlist with some helper functions.
- Alter the F_FORW (UDP message forwarding) case to also use iovecs like
  the other cases. Use sendmsg() instead of sendto().
- In the case of F_FORW, truncate the message to a size dependent on the
  address family (AF_INET, AF_INET6), as proposed by RFC 5426.
- Move all traditional message formatting into fprintlog_bsd(). Get rid
  of some of the string copying and snprintf()'ing. Simply emit more
  iovecs to get the job done.
- Increase ttymsg()'s limit of 7 iovecs to 32. Add a definition for this
  limit, so it can be reused by iovlist.
- Add fprintlog_rfc5424() to emit RFC 5424 formatted log entries.
- Add a "-O" command line option to enable RFC 5424 formatting. It would
  have been nicer if we supported "-o rfc5424", just like on NetBSD.
  Unfortunately, the "-o" flag is already used for a different purpose
  on FreeBSD.
- Don't truncate hostnames in the RFC 5424 case, as suggested by that
  specific RFC.

For people interested in using this, this feature can be enabled by
adding the following line to /etc/rc.conf:

  syslogd_flags="-s -O rfc5424"

Differential Revision:	https://reviews.freebsd.org/D15011
2018-04-15 08:34:16 +00:00
ed
b907579827 Fix enough warnings that we can build syslogd on all targets at WARNS=6.
This also fixes the build on MIPS.

Reported by:	cy (MIPS build failure)
2018-04-07 09:03:51 +00:00
ed
fa41fad703 Push RFC 5424 message format from logmsg() into fprintlog().
Now that all of parsemsg() parses both RFC 3164 and 5424 messages and
hands them to logmsg(), alter the latter to properly forward all RFC
5424 message attributes to fprintlog(). While there, make some minor
cleanups to this code:

- Instead of extending the existing code that compares hostnames and
  message bodies for deduplication, print all of the relevant message
  fields into a single string that we can compare ('saved').

- No longer let the behaviour of fprintflog() depend on whether
  'msg == NULL' to print repetition messages, Simply decompose this
  function into fprintlog_first() and fprintlog_successive(). This
  makes the interpretation of function arguments less magical and also
  allows us to get consistent behaviour across RFC 3164 and 5424 when
  adding support for the RFC 5424 output format.

- As RFC 5424 syslog messages have a dedicated application name field,
  alter the repetition messages to be printed on behalf of syslogd on
  the current system. Change these messages to use the local hostname,
  so that it's obvious which syslogd instance detected the repetition.
  Remove f_prevhost, as it has now become unnecessary.

- Remove a useless strdup(). Deconsting the message string is safe in
  this specific case.
2018-04-06 17:16:50 +00:00
ed
8a4e129ce8 Remove some places where error messages are prefixed with "syslogd".
Due to using RFC 5424, the application name is stored in a dedicated
field. It can simply be passed as an argument to logmsg() now.
2018-04-06 16:26:46 +00:00
ed
14eb2a468f Properly respect the passed in hostname for RFC 5424 messages.
Only override the hostname in case none is provided or when remote
hostnames should be ignored.
2018-04-06 16:24:03 +00:00
ed
6301688144 Add RFC 5424 syslog message parsing to syslogd.
Syslogd currently uses the RFC 3164 format for its log messages.One
limitation of RFC 3164 is that it cannot be used to log entries with
sub-second precision timestamps. One of our users has expressed a desire
for doing this for doing some basic performance measurements.

This change attempts to make a first cut at switching to RFC 5424 based
logging. The first step is to alter syslogd's input path to properly
parse such messages. It alters the logmsg() prototype to match the
fields of RFC 5424. The parsemsg() function is extended to parse both
RFC 3164 and 5424 messages and call into logmsg() accordingly.

Additional changes include:

- Introducing proper parsing of timestamps, so that they can be printed
  in any desired output format. This means we need to infer the year and
  timezone for RFC 3164 timestamps.
- Removing ISKERNEL. This can now be realised by simply providing an
  APP-NAME (== "kernel").
- Extending RFC 3164 parsing to trim off the TAG prefix and using that
  to derive APP-NAME and PROCID.
- Increase MAXLINE. RFC 5424 mentions we should support 2k messages.

Differential Revision:	https://reviews.freebsd.org/D14926
2018-04-06 12:57:01 +00:00
glebius
e72386c027 Fix whitespace issues in r330034. No functional changes. 2018-03-20 22:00:58 +00:00
dab
c815420a80 Fix two memory leaks in syslogd
A memory leak in syslogd for processing of forward actions was
reported. This modification adapts the patch submitted with that bug
to fix the leak. While testing the modification, another leak was also
found and fixed.

PR:		198385
Submitted by:	Sreeram <sreeramabs@yahoo.com>
Reported by:	Sreeram <sreeramabs@yahoo.com>
Reviewed by:	hrs
MFC after:	1 week
Sponsored by:	Dell EMC
Differential Revision:	https://reviews.freebsd.org/D14510
2018-02-26 19:27:59 +00:00
glebius
c20cb7094a When parsing remote messages, require them to have standard timestamp
field, and support properly parse out the hostname as described by RFC3164,
which wasn't done before.  However, don't discard message if it doesn't
have hostname, for compatibility.

Enable logging of the message supplied hostname instead of real hostname
with -H switch.

PR:		200933
Reported by:	Konstantin Pavlov <thresh nginx.com>
MFC after:	2 months
2017-12-05 19:54:55 +00:00
glebius
7d6335dc2e Revert r325558 as it is incorrect. 2017-11-28 19:25:01 +00:00
glebius
a271a57a8d Fix obvious NULL pointer dereference from r310350. 2017-11-28 19:18:00 +00:00
pfg
872b698bd4 General further adoption of SPDX licensing ID tags.
Mainly focus on files that use BSD 3-Clause license.

The Software Package Data Exchange (SPDX) group provides a specification
to make it easier for automated tools to detect and summarize well known
opensource licenses. We are gradually adopting the specification, noting
that the tags are considered only advisory and do not, in any way,
superceed or replace the license texts.

Special thanks to Wind River for providing access to "The Duke of
Highlander" tool: an older (2014) run over FreeBSD tree was useful as a
starting point.
2017-11-20 19:49:47 +00:00
glebius
71571f452f When parsing UDP messages skip optional hostname as described by
RFC 3164.

PR:		200933
Submitted by:	maxim
Reported by:	Konstantin Pavlov <thresh nginx.com>
MFC after:	2 weeks
2017-11-08 16:45:53 +00:00
bdrewery
a598c4b809 DIRDEPS_BUILD: Update dependencies.
Sponsored by:	Dell EMC Isilon
2017-10-31 00:07:04 +00:00
sobomax
394106c573 Fix another logic bug that came out of recent syslogd refactoring and exposed by
the r316874: don't call shutdown(2) on all sockets, but only net ones, which seems
to be the behaviour existed before that refactoring. Also don't call listen(2)
in datagram sockets and fix misplaced debug messages while I am here.

Reported by: peter
2017-04-15 18:20:11 +00:00
sobomax
e816abe173 Since shutdown(2) on datagram socket is no longer a NOP after rev 316874
don't bother to select/recv on that socket. This prevents syslogd(8)
from spinning endlessly when started with the -s option (default).

Reported by:	peter
2017-04-15 02:24:22 +00:00
hrs
5130916a38 Fix a regression which prevented an IPv6 address in a -b option from
working.

PR:	217939
Differential Revision:	https://reviews.freebsd.org/D10064
2017-03-20 17:46:33 +00:00
ngie
54577e22aa syslogd: try to print out a more helpful message in socksetup(..) if/when
getaddrinfo fails

If the asprintf call fails, fall back to the old code (as a last ditch effort
to provide the end-user with helpful output).

Sponsored by:	Dell EMC Isilon
2017-03-20 06:12:55 +00:00
ngie
745acf594e syslogd: fix dprintf in socksetup(..)
- Make the explanation more complete
- Correct a minor grammar nit with verb tense.
- Don't emit the message if `pe->pe_name` is NULL (it doesn't
  have much value).

MFC after:	1 week
Sponsored by:	Dell EMC Isilon
2017-03-20 05:12:27 +00:00
ngie
5261b98651 syslogd: don't leak f on failure in cfline(..)
Free `f` if an unknown priority or facility is parsed with the function.

MFC after:	1 week
Reported by:	Coverity
CID:		1368068
Sponsored by:	Dell EMC Isilon
2017-03-20 04:25:40 +00:00
ngie
69157f0e02 syslogd: fix memory leaks in main(..) and allowaddr(..)
- main(..): free memory assigned to fdsr before calling die(..).
- allowaddr(..): free memory assigned to ap before returning from the
  function early. Add a `err` goto label to reduce freeaddrinfo/free(ap)
  logic duplication.

MFC after:	1 week
X-MFC notes:	some of this is dependent on refactoring not MFCed
Reported by:	clang static analyzer, Coverity
CID:		1367750 (ap leakage in allowaddr(..))
Submitted by:	Tom Rix <trix@juniper.net>
Reviewed by:	ngie
Sponsored by:	Dell EMC Isilon, Juniper
Differential Revision:	D10004
2017-03-15 18:15:30 +00:00
ngie
a48f11afcf Correct nuance of -a :service -> "*" in r314563, r314585
My attempt to correct the sender/receiver behavior was incorrect.
The source port of the sender for forwarded datagrams is filtered
with -a, and my change in r314585 didn't clarify that point at all.

Wording is based on suggestion by hrs.

MFC after:	28 days
X-MFC with:	r314563, r314585
Reported by:	hrs
In collaboration with:	hrs, rgrimes
Sponsored by:	Dell EMC Isilon
2017-03-04 06:19:41 +00:00
ngie
145034f8a5 Correct verb change for service => * after r314563
`*` means that packets will be received from a remote peer on any port.
Since the point of interest is the syslogd instance (not the remote peer),
the appropriate verb is "received", not "sent".

MFC after:	1 month
X-MFC with:	r314563
Sponsored by:	Dell EMC Isilon
2017-03-03 06:13:59 +00:00
ngie
7b66c3d21b Wordsmith syslogd(8)
- Clarify -p/-S options by using appropriate subject-verb modifiers
  (verb and modifiers suggested that the subject should have been
  singular).
- Simplify/correct -a description:
-- Be more terse when describing IPv4 (the "usual dotted notation"
   isn't necessarily well understood by the reader). Being blunt and
   saying "IPv4 address" with an optional netmask is.
-- prefixlen is the appropriate terminology for IPv6.
-- mask/prefixlen is optional, not required (as noted later on in the
   section).
-- split up IPv4/IPv6 use so to clarify both forms.
-- Fix wordiness when describing the optional "service" specifier.
- -T: Use "cannot" instead of "can't" [*].

Bump .Dd for the changes.

MFC after:	1 month
Reported by:	igor [*]
Reviewed by:	hrs
Sponsored by:	Dell EMC Isilon
Differential Revision:	https://reviews.freebsd.org/D9855
2017-03-02 18:07:19 +00:00
imp
7e6cabd06e Renumber copyright clause 4
Renumber cluase 4 to 3, per what everybody else did when BSD granted
them permission to remove clause 3. My insistance on keeping the same
numbering for legal reasons is too pedantic, so give up on that point.

Submitted by:	Jan Schaumann <jschauma@stevens.edu>
Pull Request:	https://github.com/freebsd/freebsd/pull/96
2017-02-28 23:42:47 +00:00
ngie
3092c53fe7 Parameterize out the length of struct filed->f_lasttime as MAXDATELEN
This removes the hardcoded value for the field (16) and the equivalent
hardcoded lengths in logmsg(..).

This change is being done to help stage future work to add RFC5424/RFC5434
support to syslogd(8).

Obtained from:	Isilon OneFS (dcd33d13da) (as part of a larger change)
Submitted by:	John Bauman <john.bauman@isilon.com>
MFC after:	2 weeks
Sponsored by:	Dell EMC Isilon
2017-02-25 00:12:29 +00:00
ngie
f2a52db8fc Use SRCTOP instead of .CURDIR relative paths with ".."
This simplifies pathing in make/displayed output

MFC after:	1 week
Sponsored by:	Dell EMC Isilon
2017-02-24 21:35:59 +00:00
ngie
d30048e524 Sort sys/ #includes some more
MFC after:	1 week
X-MFC with:	r313358
Sponsored by:	Dell EMC Isilon
2017-02-07 01:28:55 +00:00
ngie
abc2b4926a Sort sys/ #includes and zap an unnecessary trailing space nearby
MFC after:	1 week
Sponsored by:	Dell EMC Isilon
2017-02-07 00:47:33 +00:00
ngie
034e4b75cf Use a flexible array for TypeNames instead of hardcoding the array length
MFC after:	1 week
Sponsored by:	Dell EMC Isilon
2017-02-07 00:42:55 +00:00